Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.511...7.21.0-rc.512

• aa36b38: [grid] Forward file upload/download for Kubernetes, Docker and relay sessions (#17914) (Viet Nguyen Duc) #17914

• 5d5be8c: [build] Automated Browser Version Update (#17904) (Selenium CI Bot) #17904
• 83f0b26: [grid] stop forwarding se:remoteUrl past the Node that consumes it (#17908) (Titus Fortner) #17908

• #55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
• #55169 - Changing how connection closure is handled to avoid a race condition
• #55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
• #55298 - Fix test selection for nested test classes
• #55554 - Bump to Vert.x 4.5.31
• #55560 - [3.x] maven native integration tests fail after #55461
• #55584 - Qute localization breaks with too many entries
• #55587 - Add presence checks on substituted Netty classes
• #55653 - Fix VerifyError for large Qute message bundles
• #55675 - Serialization issue in rest endpoints when class has empty constructor
• #55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
• #55760 - Upgrade Yasson from 3.0.4 to 3.0.5
• #55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
• #55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
• #55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
• #55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
• #55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
• #55849 - Merge isPublicConstructors() when a reflective class is registered twice
• #55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
• #55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
• #55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
• #55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
• #55867 - ArC: fix client proxy name collision for producers
• #55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
• #55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
• #55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
• #55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
• #55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
• #55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
• #55912 - Tree Shaker breaks hibernate filters
• #55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
• #55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
• #55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
• #55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change

• AAE-49637 Configure Mockito as a build agent to stop runtime self-attach by @mkrbr in https://github.com/Activiti/Activiti/pull/5502

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.510...7.21.0-rc.511

• #55629 - [3.x] Add post-quantum cryptography (PQC) support to TLS registry

• #47598 - Quarkus REST issue with UriInfo and matrix parameters
• #48889 - Introduce another Qute escape expression for built items
• #48940 - @RunOnVirtualThread is not working properly with use-separate-server=false
• #50123 - 3.26.2 with gradle doesn't see sources generated by quarkus-openapi-generator
• #51205 - Fine grained reactive/blocking property for specific persistence Units
• #52765 - Document how an extension can be marked as deprecated in quarkus-extension.yaml
• #53855 - Extension can be marked as deprecated in quarkus extension
• #54539 - Quarkus Data: order/sort tweaks
• #54610 - Quarkus data rename package and types
• #54694 - Move Order/Sort to PanacheQuery.sort() in quarkus-data-hibernate
• #54822 - Version Gradle file dependencies by content hash instead of lastModified
• #54826 - Startup regression SmallRyeOpenApiProcessor.prepareDocuments
• #55004 - Enable new inliner for native mode?
• #55041 - Fix gRPC @RunOnVirtualThread half-close race under load
• #55194 - Fix UriInfo matrix parameter handling in RESTEasy Reactive
• #55226 - container image deplolyment group - getEffectiveGroup does not account for a @ character
• #55242 - Bump kubernetes-client-bom from 7.7.0 to 7.8.0
• #55250 - Sanitize derived group name in container image build
• #55312 - [3.x] Upgrade pulsar client 4.2.3
• #55358 - Quickstarts compilation: test against 3.x branch instead
• #55382 - Allow per-persistence-unit control of blocking/reactive Hibernate ORM bootstrap
• #55390 - Add conditional test execution based on application properties
• #55398 - Upgrade sshd to 2.19.0
• #55435 - HibernateProcessorUtil: Add removed method to avoid API breakage
• #55439 - librariesOnly option to include only library components in generated SBOMs
• #55457 - Support build-time-only configuration to disable all runtime config source loading
• #55465 - Add quarkus.config.fixed-at-build-time to freeze all config at build time
• #55482 - Enable native mode SingleCallsiteInliner by default
• #55507 - Clear/reset integration-test boot failure state after class change and failed start
• #55511 - Correct test to tolerate containers being shut down at the end of a test
• #55532 - Fix Gradle compilation against code generated by custom providers
• #55538 - Skip building the OpenAPI document eagerly on startup
• #55541 - Fix typos and duplicated text in guide summaries
• #55563 - Bump MINIMUM GraalVM version to 25.0
• #55596 - Hibernate ORM entity enhancement fails for AdditionalPersistenceUnitBuildItem entities not on the augmentation classloader
• #55597 - Hibernate ORM: fallback to TCCL when loading entities from additional persistence units
• #55598 - [3.x] SmallRye GraphQL 2.18.4 + test for max query depth
• #55606 - Keyclok Admin link works only in the DevUI OIDC card
• #55607 - ArC: use thread-safe list for synthetic injection points
• #55612 - Add support for setting Agroal readOnly on pool config
• #55613 - Add JDBC read only config option
• #55619 - Gradle: local-projects in the serialized application model is nondeterministic across Gradle JVMs, busting the build cache
• #55626 - [3.x] Fix native image regression caused by Netty 4.1.136 SslContext API change
• #55629 - [3.x] Add post-quantum cryptography (PQC) support to TLS registry
• #55635 - DEV UI: fix sub-menu link from dynamic URL method
• #55645 - Hibernate ORM: allow to configure dialect for additional PUs
• #55647 - Serialize application model set-valued fields in a deterministic order
• #55656 - Harden aesh tests for Windows and slow CI environments
• #55663 - Optional access to application host ports from Keycloak Container
• #55667 - Update DB2 image from 12.1.0.0 to 12.1.5.0
• #55668 - Enhancements around build time dependencies in CycloneDX SBOMs
• #55704 - Enforce that only a single OIDC authentication mechanism is configured
• #55720 - Use dev services and implicit schema-management more broadly in h2-based tests
• #55725 - CI - Reuse build artifacts in PQC CI
• #55749 - Deprecate quarkus.hibernate-orm.blocking in favor of per-PU jdbc.enabled/reactive.enabled
• #55755 - Logging guide style review (3.40)
• #55791 - [3.x] Quarkus REST - Fix unbounded multipart part-header accumulation
• #55797 - [3.x] Fix path normalization
• #55877 - OIDC: KubernetesServiceClientAssertionProvider does not proactively refresh a Kubernetes client assertion
• #55885 - OIDC: fix periodic bearer token refresh from filesystem
• #55921 - Qute: support multi-pipe CDATA delimiters
• #55938 - [3.x] Bump smallrye-reactive-messaging.version from 4.36.0 to 4.37.0

Release note 1.4.9:

1. 机器人API添加获取owner好友列表功能。
2. 机器人API添加获取owner拥有机器人列表功能。
3. 机器人API添加获取搜索用户功能。
4. 添加操作日志功能。

附件的版本有3种格式，分别是Java通用版本、Deb格式安装包和Rpm格式安装包包，可以根据平台或者自己的习惯下载其中一种软件包。另外在Github也可以下载。也可以下载我们网站上的最新版本，通用Java包，deb格式安装包和rpm格式安装包。 *** 0.42 版本增加了群成员数限制，默认为2000。如果您想修改默认值，可以在升级版本之后，修改t_setting表，把默认的大小改为您期望的。另外修改t_group表，把已经存在的群组max_member_count改成您期望的，然后重启。*** *** 0.46和0.47版本升级到0.48及以后版本时，可能会提示flyway migrate 38错误，请执行 修复脚本 进行修复。0.46和0.47版本之外的版本不会出现此问题。*** *** 0.50版本添加了是否允许客户端发送群操作通知的配置。如果您在客户端自定义群通知，需要在服务器端配置允许，没有使用自定义群操作通知的不受影响。*** *** 从0.54之前版本升级到0.54及以后版本时，会提示flyway migrate错误。因为0.54版本删除了sql脚本中默认敏感词的内容，flyway checksum失败。请执行update flyway_schema_history set checksum = 0 where script = 'V17__add_default_sensitive_word.sql';来修复。*** *** 从0.59之前的版本升级到之后的版本执行数据库升级时间比较长，请耐心等待提示运行成功，避免中途中断。 *** *** 0.62/0.63 版本有严重的问题，请使用0.64及以后版本，或者0.61版。 *** *** 从0.68 版本起添加了pc在线是否默认手机接收推送的开关，默认为开，与以前版本作用相反，请注意兼容（可以关掉与之前保持一致或者升级客户端） *** *** 从0.78 版本起把MySQL数据库中关键字都改为大小写敏感，另外生成id的方法也做了改变，只生成小写的id，避免出现id重复的问题，建议所有客户都升级 *** *** 从0.79 版本起把log4j升级到log4j2，因为log4j已经不再维护而且还有已知的漏洞，建议所有客户都升级，升级时注意更新log4j2的配置文件 *** *** 0.97版本更改了启动脚本wildfirechat.sh，如果是升级服务，请注意更新启动脚本。*** *** 1.3.8版本添加了server api发送消息的限制，限制消息体最大内容不能超过64KB，如果升级请注意业务系统发送消息大小。***

• e24614e: [build] Automated Browser Version Update (#17899) (Selenium CI Bot) #17899
• 86293a1: [py]: fix W3C capabilities built from a list of options (create_matches) (#17897) (Navin Chandra) #17897
• 0003281: [rb] add low-level BiDi protocol integration specs (#17878) (Titus Fortner) #17878
• d05f029: Fix badge for CI build on the default branch (#17901) (Nikolay Borisenko) #17901
• 80f0c34: [py] Fix broken reStructuredText link in docs (#17902) (Corey Goldberg) #17902

https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.